CVE-2026-90389 md: scope memalloc_noio to allocation critical sections

In the Linux kernel, the following vulnerability has been resolved: md: scope memallocnoio to allocation critical sections Storing a memallocnoiosave token in mddev-noioflags lets one task save the token and another task restore it. With concurrent suspend sysfs writes, task A can enter...

CVE-2026-90388 iommu/dma: Check atomic pool allocation result directly

In the Linux kernel, the following vulnerability has been resolved: iommu/dma: Check atomic pool allocation result directly The non-blocking, non-coherent allocation path uses dmaallocfrompool, which returns the allocated page and fills cpuaddr only on success. Do not rely on cpuaddr to detect...

CVE-2026-90387 swiotlb: Preserve allocation virtual address for dynamic pools

In the Linux kernel, the following vulnerability has been resolved: swiotlb: Preserve allocation virtual address for dynamic pools swiotlballoctlb can allocate from the DMA atomic pool when a decrypted pool is needed from atomic context. With CONFIGDMADIRECTREMAP, the atomic pool is backed by...

CVE-2026-90385 md/raid1: create serial pool adding rdev to array with serialize_policy=1

In the Linux kernel, the following vulnerability has been resolved: md/raid1: create serial pool adding rdev to array with serializepolicy=1 The following bug has been observed with kernel 7.1.3 after adding a new rdev to an existing RAID1 array with serializepolicy enabled: Oops: 0002 1 CPU: 0...

CVE-2026-90386 i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices

In the Linux kernel, the following vulnerability has been resolved: i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices On an empty bus ENTDAA assigns nothing, so cmd-rxlen the count of addresses left unassigned equals master-maxdevs. The GENMASK index master-maxdevs - cmd-rxlen - 1 th...

CVE-2026-90384 iomap: release the folio batch on iomap callback failures

In the Linux kernel, the following vulnerability has been resolved: iomap: release the folio batch on iomap callback failures A sashiko review of an unrelated patch points out that the folio batch mechanism used for iomap zero range fails to release the batch in a couple error scenarios. If eithe...

CVE-2026-90382 wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length The MPDU length in the rx descriptor comes from the hardware. In monitor mode with the fcsfail filter enabled, the hardware passes up corrupted frames, and a...

CVE-2026-90383 misc: sgi-gru: remove interrupt-context page-table walks

In the Linux kernel, the following vulnerability has been resolved: misc: sgi-gru: remove interrupt-context page-table walks The GRU TLB miss handler walks a process's page tables without holding page-table locks or a reference to the mapped page. It also uses a kernel page-table accessor on user...

CVE-2026-90381 wifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix handling channel context with different bands in mt76switchvifchanctx When performing channel switches on different radios within a short timeframe, channel contexts with different bands can be carried for each...

CVE-2026-90380 wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt792x: fix use-after-free in mt76rxpollcomplete A use-after-free issue occurs in mt76rxpollcomplete due to a race condition. The STA has already been removed, but the rxstatus still had a pointer to the wcid in the...

CVE-2026-90379 wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash When an AER error occurs and the bus is hung, the register reads return 0xFFFFFFFF, causing the DMA queue state to be corrupted and resulting in an invalid...

CVE-2026-90378 wifi: mt76: mt792x: Fix memory leak in SDIO TX path

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt792x: Fix memory leak in SDIO TX path When txprepareskb returns an error in the SDIO TX path, the skb is not freed, leading to a memory leak. This can occur when zero-length frames such as WNM NULL frames are droppe...

CVE-2026-90377 wifi: mt76: fix RX data queuing of RRO 3.0

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix RX data queuing of RRO 3.0 For RRO 3.0, RX data released from a RRO data queue should be put to the indicator queue. The frames are processed and completed in the context of the indicator queue NAPI, which only...

CVE-2026-90376 wifi: mt76: mt7996: fix MLD ID in MAC TXD and HIF TXP

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix MLD ID in MAC TXD and HIF TXP Problem: MCU command timeout while the firmware state is normal, and the firmware keeps showing the error log "ERROR!! NO PAUSE...". Root cause: If the MLDID field in the TXD ...

CVE-2026-90375 wifi: mt76: fix non-AQL packet accounting for MLO stations

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix non-AQL packet accounting for MLO stations mt76txqueueskb overrides the wcid passed by the driver with sta-drvpriv, so the wcid might incorrectly be changed after TX, causing wcid-nonaqlpackets to be counted on th...

CVE-2026-90374 wifi: mt76: mt7996: validate RX band_idx before dereferencing phys[]

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate RX bandidx before dereferencing phys bandidx comes from a 2-bit descriptor field 0-3 and was used directly to index dev-mt76.phys size MTMAXBAND == 3 and dereference the result. A corrupt or reserved...

CVE-2026-90373 wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear mt7915removeinterface cleared the wcid mask bit with no lock held and before clearing the RCU wcid pointer. The mask is a non-atomic RMW shared with the...

CVE-2026-90371 wifi: mt76: fix RXDMAD_C buffer recycling race

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix RXDMADC buffer recycling race The RXDMADC buffers come from the RRO data queues' page pools, which are bound to a different NAPI, so the direct page-pool recycle used here could race the owning NAPI; take the...

CVE-2026-90372 wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: avoid nss underflow in mt7915mcugetstanss If a peer's VHT/HE MCS map has no supported spatial stream all fields 0x3, the loop exits with nss == 0 and the function returned u8-1 255, which was then written into...

CVE-2026-90370 wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound TLV walk in mt7996mcugetchipconfig The response TLV loop advanced by tlv-len without a minimum, so a theoretical firmware response containing a zero-length TLV could spin forever, hanging the CPU during...

CVE-2026-90368 wifi: mt76: mt7915: unwind state on add_interface failure

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: unwind state on addinterface failure When mt76wcidalloc fails, mt7915addinterface returned without clearing the vifmask/omacmask bits it had already set, without removing the firmware dev info added earlier, a...

CVE-2026-90369 wifi: mt76: fix out-of-bounds access in mmio copy helpers

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix out-of-bounds access in mmio copy helpers mt76mmiowritecopy and mt76mmioreadcopy iterate up to ALIGNlen, 4, so a length that is not a multiple of four reads past the source buffer writecopy or writes past the...

CVE-2026-90367 wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: hold dev-mt76.mutex while disabling tx worker in SER mt7996macresetwork parked the tx worker and disabled the RX/TX NAPIs before taking dev-mt76.mutex. mt76workerdisable/enable are plain kthread park/unpark, n...

CVE-2026-90365 wifi: mt76: cancel reset and rc work on device unregister

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: cancel reset and rc work on device unregister Both drivers cancelled dumpwork on unregister but left resetwork and rcwork to be flushed only by destroyworkqueue in mt76freedevice, which runs after the hw is unregister...

CVE-2026-90366 wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV When a CSA countdown is active, mt7996mcubeaconcntdwn emits two bssbcncntdwntlv entries the CSA countdown and the CCA-abort BCC, but MT7996BEACONUPDATESIZE only...

CVE-2026-90364 ACPI: processor: Unregister cpufreq notifier on init failure

In the Linux kernel, the following vulnerability has been resolved: ACPI: processor: Unregister cpufreq notifier on init failure acpiprocessordriverinit registers the cpufreq policy notifier before registering the ACPI processor driver and setting up CPU hotplug state. If driverregister or...

CVE-2026-90363 drm/msm: don't tear down KMS twice when KMS init fails

In the Linux kernel, the following vulnerability has been resolved: drm/msm: don't tear down KMS twice when KMS init fails When priv-kmsinit mdp4kmsinit / mdp5kmsinit fails partway through, both display drivers already tear their KMS state down via mdp4destroy / mdp5kmsdestroy before returning th...

CVE-2026-90362 drm/msm/dsi: Drop dev_pm_opp_set_rate(0)

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dsi: Drop devpmoppsetrate0 devpmoppsetrate0 removes the vote specified in required-opps but does not actually park the clock, making it run without the necessary power backing. Drop the explicit call to it. Every call sit...

CVE-2026-90361 wifi: ath11k: fix leak in ath11k_service_ready_ext_event()

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix leak in ath11kservicereadyextevent Currently, during ath11kservicereadyextevent processing, svcrdyext.macphycaps can be allocated during TLV parsing. This is a temporary allocation that is freed on the success...

CVE-2026-90360 regulator: core: use system_freezable_wq for init complete work

In the Linux kernel, the following vulnerability has been resolved: regulator: core: use systemfreezablewq for init complete work scheduledelayedwork uses systemwq, which is non-freezable, allowing regulatorinitcompletework to run concurrently with system suspend. This work fires 30s after boot t...

CVE-2026-90359 bpf: Reject >8 byte return values on return-reading trampoline paths

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject 8 byte return values on return-reading trampoline paths btfdistillfuncproto builds the function model used for the fentry/fexit/fmodret/fsession trampolines and structops. It has accepted a 16-byte int128 return value...

CVE-2026-90358 bpf, x86: Fix trampoline stack size for 128-bit arguments

In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix trampoline stack size for 128-bit arguments btfdistillfuncproto accepts a function argument up to 16 bytes, so a 128-bit scalar such as int128 reaches the x86 trampoline with argsize == 16. But the current...

CVE-2026-90357 wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement The flow is added to dev-twtlist before sending the agreement to the firmware, but the error path leaves it linked while flowidmask is never set. The flow slot...

CVE-2026-90356 wifi: mt76: mt7996: free vif links after clearing wcid entries on full reset

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: free vif links after clearing wcid entries on full reset mt7996macresetvifiter queues non-default vif links for kfreercu while dev-wcid still holds pointers to the wcid embedded in each freed link;...

CVE-2026-90355 wifi: mt76: mt7996: clear stale link state on full reset

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: clear stale link state on full reset After a full chip reset, mac80211 reconfig replays interface, link and channel context setup. mt7996viflinkadd short-circuits when the linkid is still marked in...

CVE-2026-90353 wifi: mt76: mt7915: fix ext PHY use-after-free on register error path

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: fix ext PHY use-after-free on register error path After mt7915registerextphy succeeded, a failure of the main PHY mt7915initdebugfs or mt7915coredumpregister unwound through freephy2, which called...

CVE-2026-90354 wifi: mt76: mt7915: fix double hif2 init on the non-WED path

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: fix double hif2 init on the non-WED path mt7915pciinithif2 was called unconditionally and again inside the WED-inactive branch. The helper increments the global hifidx, writes the PCIe RECOGID register and tak...

CVE-2026-90352 wifi: mt76: mt7915: release hif2 reference on probe IRQ failure

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: release hif2 reference on probe IRQ failure The hif2 reference obtained by mt7915pciinithif2 is only released on error paths that key off dev-hif2, which is not assigned until after the IRQ setup. If...

CVE-2026-90351 wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed If the WED attach for the primary PCIe function fails, the probe path still attached wedhif2 for the secondary function, leaving the device in an...

CVE-2026-90350 wifi: mt76: reject out-of-range link ids in mt76_vif_link()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: reject out-of-range link ids in mt76viflink mt76viflink indexes mvif-link without validating linkid, but callers pass mvif-deflinkid / msta-deflinkid, which hold IEEE80211LINKUNSPECIFIED 0xf until the first link has...

CVE-2026-90349 wifi: mt76: mt7996: fix out-of-bounds link array access in mt7996_tx()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix out-of-bounds link array access in mt7996tx When mac80211 leaves the link unspecified, mt7996tx substitutes the primary link id of the station or vif. That value is IEEE80211LINKUNSPECIFIED 0xf until the...

CVE-2026-90347 arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry

In the Linux kernel, the following vulnerability has been resolved: arm64: ptrace: Keep 'origx0' in-sync with x0 on syscall entry Commit e057b9477232 "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" attempted to resolve a long-standing issue with syscall entry tracing, where ...

CVE-2026-90348 wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump

In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: snoc: use memcpyfromio for MSA ramdump On WCN3990/SNOC the MSA region is mapped with devmmemremapMEMREMAPWT. On arm64 such a mapping is not Normal-cacheable, so unaligned accesses to it are not permitted...

CVE-2026-90346 wifi: nl80211: clean up color-change beacon data on errors

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: clean up color-change beacon data on errors nl80211colorchange calls nl80211parsebeacon for the beaconnext template, which can allocate params.beaconnext.mbssidies and .rnries. A parsing failure returned directly...

CVE-2026-90344 wifi: mac80211: disconnect on CSA to channel 0

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: disconnect on CSA to channel 0 The refactor for the CSA parsing erroneously equates channel zero and no information present, leading it to ignore a CSA on an AP that advertises a switch to that invalid channel. Th...

CVE-2026-90345 wifi: brcmfmac: fix P2P action frame handling without device vif

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix P2P action frame handling without device vif Some P2P action frame paths assume the P2P device vif is always available. That is not true when userspace sends non-P2P public action frames through the primary...

CVE-2026-90343 wifi: cfg80211: stop PMSR before P2P and NAN teardown

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: stop PMSR before P2P and NAN teardown PMSR request teardown must abort active measurements while the wirelessdev is still present in the driver. cfg80211leavelocked and cfg80211stoppd already do this before invoki...

CVE-2026-90342 bpf: Fix mmap_lock deadlock on arena lock failure

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix mmaplock deadlock on arena lock failure Reported by the Sashiko AI review. arenavmfault returns VMFAULTRETRY when it can't take arena-spinlock, but it never took mmaplock. The fault path assumes a VMFAULTRETRY handler...

CVE-2026-90341 firmware: coreboot: Validate table bounds

In the Linux kernel, the following vulnerability has been resolved: firmware: coreboot: Validate table bounds The existing coreboottablepopulate bounds checks limit individual entries to the mapped length. However, coreboottableprobe replaces the platform resource length with header and table siz...

CVE-2026-90340 pinctrl: generic: free maps on pinctrl_generic_to_map() failure

In the Linux kernel, the following vulnerability has been resolved: pinctrl: generic: free maps on pinctrlgenerictomap failure pinctrlgenerictomap parses DT configuration and allocates pinctrl maps via pinctrlutilsreservemap. If subsequent steps such as pinctrlutilsaddmapmux,...